Hi all,
I have a domain environment with AD. There are about 25 users with PCs, and they primarily only need to use their assigned PC and not log in to others. Over the years, I have emailed, memo-ed, sticky-noted, and even gone full-blown Acceptable Use Policy in an effort to make sure everyone knows that they should NEVER share their password with anyone but me (the only IT guy) or the owner of the company, if he asks.
I have explained that different people have access to different folders on the shared drive based on their login credentials. I have explained that sharing your password allows others to access your email. I have explained that using someone else's password can make it very difficult or impossible for me to backtrack and find out what happened if something goes wrong on our network or in our various software systems. I have explained that if something goes wrong, and it is traced back to your user account, you will have to take the blame even if it wasn't you. I've explained that if we get audited or sued and our accounting records get scrutinized, it could look like you did something wrong that you didn't do. I've explained that someone you share your password with may decide to embezzle money or otherwise steal from the company under your name.
It's been covered nine ways to Sunday...
This morning I notice one of our Outside Sales Reps sitting in our Production Manager's office, working on his PC. I know this guy has his own office and laptop, so out of curiosity I say, "Hey man, what are you doing in here?' He says, "I'm uploading jobsite photos into the system. R*** has jury duty and will be out till next Tuesday." News to me. Knowing that only the Production Manager and myself have write access to the directory where the pictures get stored, after a moment's pause I say, "Um... Who are you logged in as?" He says, "Uh, **** (prod. mgr.)"
Awesome!! So, he leaves for jury duty, doesn't say a word to me about it, and gives his password (both to the PC and to our Work Order software) to someone who has exceedingly little experience with that part of our systems. What could go wrong?!
Unfortunately, I see password sharing going on fairly regularly. Now, I've asked and pleaded and stated the case for not sharing passwords, to have it largely ignored. And with the way we are set up, I have no real authority to hand out disciplinary action for disregarding the rules. If I institute mandatory changing of passwords on a set schedule, people get pissed off and think I'm just being and asshole. I can't win!
Anyone else have problems with this? What advice do you have?